Which versions of Traefik are affected by CVE-2026-54763?

Traefik reverse proxy in versions prior to 2.11.51, 3.6.22, and 3.7.6 is vulnerable to authentication bypass attacks via header spoofing, allowing unauthorized access to protected backend…. A patch is available.

Is there a public PoC exploit available for CVE-2026-54763?

Yes, a public proof-of-concept exploit is available for CVE-2026-54763. Prioritise patching immediately. EPSS: 0.3%.

How to fix or mitigate CVE-2026-54763?

Within 24 hours: Identify all Traefik instances in your environment and document their versions and authentication middleware configuration. Within 7 days: Upgrade all instances to Traefik v2.11.51 (v2.x branch), v3.6.22 (v3.6.x branch), or v3.7.6 (v3.7.x branch), with thorough testing in staging before production rollout. Within 30 days: Validate all upgrades are complete; review authentication and access logs for suspicious activity patterns; conduct post-remediation security validation.

Traefik CVE-2026-54763

Q: What is the CVSS score of CVE-2026-54763?

CVE-2026-54763 has a CVSS 4.0 base score of 7.8 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-41940 HIGH

Improper Handling of Case Sensitivity (CWE-178)

2026-07-06 GitHub_M

GHSA-x677-9fxg-v5c5

Code Injection Red Hat Canonical Traefik Suse

7.8

CVSS 4.0 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

7.8 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

SUSE

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Red Hat

10.0 HIGH

qualitative

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jul 06, 2026 - 22:02 EUVD

Analysis Generated

Jul 06, 2026 - 21:35 vuln.today

DescriptionCVE.org

Traefik is an HTTP reverse proxy and load balancer. Prior to v2.11.51, v3.6.22, and v3.7.6, Traefik's BasicAuth, DigestAuth, and ForwardAuth middlewares strip canonical-cased spoofed identity headers before writing Traefik's own value, but do not account for underscore-variant header names, which many backends normalize identically to dashed forms. An attacker able to reach a protected route can inject an underscore-variant header that survives Traefik's stripping and reaches the backend alongside, or on the unauthenticated ForwardAuth authResponseHeaders path instead of, the value Traefik intended to set, spoofing identity or authorization context. This issue is fixed in versions v2.11.51, v3.6.22, and v3.7.6.

AnalysisAI

Identity/authorization header spoofing in Traefik reverse proxy (before v2.11.51, v3.6.22, and v3.7.6) lets an attacker reaching a protected route smuggle an underscore-variant HTTP header past the BasicAuth, DigestAuth, and ForwardAuth middlewares' sanitization. Traefik strips canonical dashed spoofed headers before setting its own trusted value but ignores underscore forms (e.g. X_Forwarded_User vs X-Forwarded-User) that many backends normalize identically, so the forged header reaches the backend alongside — or, on the ForwardAuth authResponseHeaders path, instead of — Traefik's intended value. There is no public exploit identified at time of analysis and the issue is not in CISA KEV, but a vendor fix and upstream commit are published.